Minor macOS security update guide

This guide is only for minor updates inside the same macOS family, such as a security update or “dot” update like 15.3 to 15.3.1, 14.7.1 to 14.7.2, and similar. It is not for a major upgrade to a new macOS generation, such as Sonoma to Sequoia or Sequoia to Tahoe.

A Quick Explanation Before You Start

Your Mac uses two different OCLP-related pieces to run newer software:

1. OpenCore itself: This is the boot layer that helps an unsupported Mac start a newer macOS version. OCLP recommends keeping this bootloader updated before running a macOS update.
2. Root patches: These are the extra system-level patches that restore things older Macs may lose on newer macOS versions, such as graphics acceleration, Wi-Fi, Bluetooth, camera support, and other hardware functions. After a macOS update, these root patches are usually removed and must be installed again.

Before You Begin

Please complete these preparation steps first:

• Back up your Mac. Apple recommends backing up before installing new software. A Time Machine backup is best if you have one.
• Plug the Mac into power for the entire process. Installation can restart the Mac several times and should be allowed to finish uninterrupted.
• Ensure a stable internet connection. This is important because some Macs need extra OCLP support packages during post-update patching. Ethernet is even better if available.
• Save your work and close open apps. The Mac will restart during the update.

Step-by-Step Guide

Step 1: Confirm the offered update is only a minor/security update

On the Mac, click the Apple menu > About This Mac to see your current macOS version. Then go to Apple menu > System Settings > General > Software Update and look carefully at the offered update. Apple describes a minor update as a new release inside the currently installed macOS version, while a major upgrade changes to a new named macOS generation.

Examples of updates this guide covers:

• Sequoia 15.x to another Sequoia 15.x version
• Sonoma 14.x to another Sonoma 14.x version
• Ventura 13.x to another Ventura 13.x version

If you see a major new version instead, do not continue. OCLP recommends a USB-based process for major upgrades rather than using System Settings.

Step 2: Open OpenCore Legacy Patcher before doing the macOS update

Open Applications and launch OpenCore-Patcher.app. OCLP recommends being on the latest OCLP version before performing a macOS update. If the app says an update is available for OCLP itself, install that first. After the app updates, it may ask if you want to update OpenCore and root patches; if you are not changing any special settings, accepting that update is the normal path.

Step 3: Rebuild and reinstall OpenCore to the internal drive

Still inside OCLP, choose Build and Install OpenCore. Let it build, then choose Install OpenCore and select the internal drive/EFI when prompted. OCLP specifically recommends rebuilding OpenCore to the internal disk before a macOS update. Note: OpenCore configurations are hardware-specific, so you should not change the model or advanced settings unless instructed to do so.

Step 4: Run the Apple security/minor update from Software Update

Now go to Apple menu > System Settings > General > Software Update. If needed, click the info/details area next to available updates and make sure only the minor/security update is selected. Then click Update Now, Upgrade/Update, or Restart Now. Software Update may ask for your administrator password before installation starts.

During installation:

• Leave the Mac plugged into power.
• Do not close the lid on a laptop.
• Do not force shut down the Mac.
• It is normal for the Mac to restart several times.
• It is normal to see a progress bar or a blank screen during part of the process.

Step 5: Log back in after the update finishes

After the update completes, log in normally. Because your OCLP background helper is disabled, you should not wait for OCLP to pop up automatically. You need to open the OCLP app yourself.

At this stage, the Mac may still boot, but hardware features can be reduced until root patches are reapplied. Common symptoms of missing root patches include sluggish graphics, missing transparency effects, odd display behavior, or missing Wi-Fi/Bluetooth, depending on the model.

Step 6: Reinstall the root patches manually

Open Applications and launch OpenCore-Patcher.app again. From the main menu, open the Post Install Volume Patch section. Let OCLP scan the system and show the patches it wants to apply, then follow the on-screen option to install/apply those patches.

You may be asked for your administrator password. This is normal, because root patching makes controlled changes to protected system components that older Macs need to regain full functionality. These patches require on-disk system changes, which is why they do not survive a normal macOS update.

Step 7: Restart again after root patching

When OCLP finishes patching, restart the Mac if prompted. After reboot, graphics, Wi-Fi, Bluetooth, camera, and other hardware-dependent features should return to their normal patched state for your specific Mac model.

Step 8: If OCLP asks for additional downloads, let it complete them

Some Macs need extra support packages during post-update root patching. OCLP documents two common cases:

• KDK / Kernel Debug Kit: Needed on certain Macs with older AMD GCN graphics when running Ventura or newer.
• MetallibSupportPkg: Needed on some Sequoia systems using certain older Intel or NVIDIA graphics.

If OCLP says it needs internet or additional packages, keep the Mac online and let it download what it needs. On some systems, the first patch run may install only Wi-Fi support first so you can get online. After that, you reboot, reconnect to the internet, and run root patching again to install the rest, including graphics patches. Using Ethernet can help everything install in one pass.

What is Normal After the Update

• The update download may seem large. OCLP explains that root patching breaks Apple’s sealed system volume, so macOS often downloads a larger update package to restore the system to Apple’s expected state.
• The Mac may restart more than once during installation.
• The screen may go black for a while, then return.
• The Mac may seem visually wrong right after the update but before root patching. That usually means the root patches simply have not been reinstalled yet.

What NOT to Do

• Do not install a beta macOS version. OCLP explicitly warns that beta support is not dependable.
• Do not change OCLP model settings unless you know exactly why. OpenCore configurations are hardware-specific.
• Do not erase the disk in Disk Utility for a normal security update. That is only for reinstall/wipe scenarios.
• Do not confuse Apple’s background security with OCLP’s background helper. Apple’s setting controls Apple’s background security content, while OCLP’s handles patcher-specific checks.